How to Check If Your Windows 11 PC Has Been Compromised

Running a compromised Windows 11 machine exposes your personal files, banking credentials, and network identity to unauthorized access. Rather than waiting for a ransom note or a strange pop-up, you can run a systematic check using tools already installed on your device. This guide walks you through every verification step, explains what normal activity looks like, and shows you how to respond when something falls outside the expected range.

Before You Start: Close all open applications, save your work, and keep a secondary device nearby so you can reference this guide without interruption. If your PC is currently locked out, infected with ransomware, or showing severe instability, skip straight to the troubleshooting section at the bottom.

Step 1: Identify obvious warning signs

Start by observing how your system behaves under normal conditions. A compromised machine often reveals itself through performance drops, unexpected prompts, or altered settings.

Open Settings > System > Power & battery and note your battery drain rate.
Watch your taskbar for unfamiliar icons, persistent notification pop-ups, or browser redirects.
Listen for unusual fan activity or check if your cursor moves on its own.

If you notice these symptoms, do not dismiss them as routine background updates. Legitimate Windows processes run quietly, and they rarely trigger permission prompts or redirect your default search engine. When you spot a pattern that persists for more than an hour, move to Step 2 immediately.

Close-up of a laptop screen showing the Windows 11 Task Manager with CPU and memory columns highlighted, soft focus desk — Task Manager view used to identify unfamiliar running processes on Windows 11

Step 2: Inspect running processes for unfamiliar activity

The Task Manager gives you a real-time view of everything executing on your system. Malware often hides under generic names or runs under the context of trusted Windows services.

Press Ctrl + Shift + Esc to open Task Manager.
Click More details at the bottom if you see the compact view.
Sort the Processes tab by CPU and Memory columns.
Right-click any suspicious entry and select Open file location to verify the folder path.

You will see a list of active programs ranked by resource usage. Legitimate entries typically live in C:\Windows, C:\Program Files, or C:\Program Files (x86). If an entry points to a temporary folder like C:\Users\YourName\AppData\Local\Temp or a random directory, flag it for the next step. If Task Manager freezes or refuses to close, force quit it with Alt + F4 and proceed to Step 3.

Step 3: Review installed apps and startup programs

Attackers frequently install persistence mechanisms so their code launches automatically when you sign in. Checking your installed applications and startup list removes that blind spot.

Open Settings > Apps > Installed apps and sort by Install date.
Scan the top entries for software you do not recognize or never downloaded.
Navigate to Settings > Apps > Startup and toggle off anything you cannot verify.
Right-click unverified startup items and choose Open file location before uninstalling.

You will see a chronological list of every program added to your system. Windows 11 groups entries by publisher, which helps you spot duplicates or renamed installers. If you find an application you cannot identify, do not uninstall it yet. Note the publisher name, search it in a separate browser on your phone, and compare the results before removing it. If the Installed apps page fails to load, run sfc /scannow in an elevated Command Prompt to repair system files first.

Step 4: Check active network connections for unknown traffic

A compromised device often phones home to a command-and-control server. Monitoring your active connections reveals whether your PC is communicating with unfamiliar addresses.

Open Settings > Network & internet > Advanced network settings > Network diagnostics and run the troubleshooter.
Open cmd, type netstat -ano, and press Enter.
Look for entries with a State of ESTABLISHED paired with external IP addresses you do not recognize.
Match the PID column to a process name in Task Manager to identify the responsible application.

You will see a long list of active ports, protocols, and remote addresses. Normal traffic usually involves known services like dns.microsoft.com, login.live.com, or your router’s local IP. Connections to unfamiliar IP ranges, especially on non-standard ports like 4444 or 8080, warrant immediate investigation. If the command prompt returns an access denied error, right-click cmd in the Start menu, select Run as administrator, and repeat the command.

A Windows 11 desktop showing a completed Windows Security scan results page with green checkmarks and a clean status ind — Windows Security scan results confirming your system is free of detected threats

Step 5: Run a full Windows Security scan

Microsoft Defender provides layered protection that catches known threats, suspicious behavior, and potentially unwanted applications. A full scan takes longer than a quick check but uncovers hidden infections.

Open Settings > Privacy & security > Windows Security.
Click Virus & threat protection and select Scan options.
Choose Full scan and confirm the action.
Wait for the progress bar to reach 100 percent before closing the window.

You will see a detailed report listing detected items, their severity, and recommended actions. Windows 11 quarantines threats automatically and blocks execution attempts. If the scan reports no issues but you still suspect compromise, switch to Microsoft Defender Offline scan from the same menu. This restarts your PC into a pre-boot environment that catches rootkits hiding from the active operating system. If Defender refuses to update its definitions, check your internet connection and run wsreset.exe to reset the Microsoft Store cache.

Step 6: Verify account and permission changes

Attackers often escalate privileges or create hidden user accounts to maintain long-term access. Auditing your account settings closes that back door.

Open Settings > Accounts > Family & other users and review the full user list.
Navigate to Settings > Accounts > Your info and confirm your account type is Administrator.
Open Control Panel > User Accounts > Manage another account and check for unfamiliar profiles.
Review Settings > Privacy & security > Windows Security > App & browser control for disabled security features.

You will see every account that can sign in to your machine, along with their permission level. Legitimate systems rarely contain more than three to four accounts, and guest profiles should be disabled. If you discover an unknown administrator account, remove it immediately, change your password, and enable two-factor authentication on your Microsoft account. If the Settings app crashes when you open the Accounts section, boot into Safe Mode and run the steps from a Command Prompt using net user commands.

Troubleshooting Common Issues

Task Manager will not open or freezes: Press Ctrl + Alt + Delete, select Task Manager, and if that fails, use Ctrl + Shift + Esc again. If both fail, force restart with the power button and boot into Safe Mode by holding Shift while clicking Restart.
Windows Security scans fail or show outdated definitions: Open Settings > Windows Update > Advanced options > Optional updates and install any pending security patches. Then run wsreset.exe and restart your PC.
netstat returns access denied or shows no output: Right-click the Start button, choose Terminal (Admin) or Command Prompt (Admin), and rerun netstat -ano. If you still see no results, your network adapter may be disabled; re-enable it in Device Manager.

Pro Tip: Create a system restore point before removing any flagged files. Open Control Panel > Recovery > Open System Restore and follow the prompts so you can roll back changes if an uninstall breaks a legitimate application.

After completing all six steps, you should have a clear picture of your system’s health. Keep Windows Update enabled, use a password manager to rotate credentials, and run a quick Defender scan weekly to catch new threats early. If you followed every step and still notice strange behavior, back up your important files to an external drive and perform a clean Windows 11 reinstall from Microsoft’s official media creation tool.

Closing Question: Which built-in Windows 11 tool surprised you the most when you used it to verify your system’s security?

Over to you: Which built-in Windows 11 tool surprised you the most when you used it to verify your system’s security?